<?xml version="1.0" encoding="ascii"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
          "DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
  <title>Forensie.Forensie</title>
  <link rel="stylesheet" href="epydoc.css" type="text/css" />
  <script type="text/javascript" src="epydoc.js"></script>
</head>

<body bgcolor="white" text="black" link="blue" vlink="#204080"
      alink="#204080">
<!-- ==================== NAVIGATION BAR ==================== -->
<table class="navbar" border="0" width="100%" cellpadding="0"
       bgcolor="#a0c0ff" cellspacing="0">
  <tr valign="middle">

  <!-- Tree link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="module-tree.html">Trees</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Index link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="identifier-index.html">Indices</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Help link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="help.html">Help</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Project homepage -->
      <th class="navbar" align="right" width="100%">
        <table border="0" cellpadding="0" cellspacing="0">
          <tr><th class="navbar" align="center"
            ><a class="navbar" target="_top" href="http://code.google.com/p/forensie/">Forensie</a></th>
          </tr></table></th>
  </tr>
</table>
<table width="100%" cellpadding="0" cellspacing="0">
  <tr valign="top">
    <td width="100%">
      <span class="breadcrumbs">
        <a href="Forensie-module.html">Module&nbsp;Forensie</a> ::
        Class&nbsp;Forensie
      </span>
    </td>
    <td>
      <table cellpadding="0" cellspacing="0">
        <!-- hide/show private -->
        <tr><td align="right"><span class="options">[<a href="javascript:void(0);" class="privatelink"
    onclick="toggle_private();">hide&nbsp;private</a>]</span></td></tr>
        <tr><td align="right"><span class="options"
            >[<a href="frames.html" target="_top">frames</a
            >]&nbsp;|&nbsp;<a href="Forensie.Forensie-class.html"
            target="_top">no&nbsp;frames</a>]</span></td></tr>
      </table>
    </td>
  </tr>
</table>
<!-- ==================== CLASS DESCRIPTION ==================== -->
<h1 class="epydoc">Class Forensie</h1><p class="nomargin-top"><span class="codelink"><a href="Forensie-pysrc.html#Forensie">source&nbsp;code</a></span></p>
<!-- ==================== NESTED CLASSES ==================== -->
<a name="section-NestedClasses"></a>
<table class="summary" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr bgcolor="#70b0f0" class="table-header">
  <td colspan="2" class="table-header">
    <table border="0" cellpadding="0" cellspacing="0" width="100%">
      <tr valign="top">
        <td align="left"><span class="table-header">Nested Classes</span></td>
        <td align="right" valign="top"
         ><span class="options">[<a href="#section-NestedClasses"
         class="privatelink" onclick="toggle_private();"
         >hide private</a>]</span></td>
      </tr>
    </table>
  </td>
</tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
        <a href="Forensie.Forensie.FormatError-class.html" class="summary-name">FormatError</a>
    </td>
  </tr>
</table>
<!-- ==================== INSTANCE METHODS ==================== -->
<a name="section-InstanceMethods"></a>
<table class="summary" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr bgcolor="#70b0f0" class="table-header">
  <td colspan="2" class="table-header">
    <table border="0" cellpadding="0" cellspacing="0" width="100%">
      <tr valign="top">
        <td align="left"><span class="table-header">Instance Methods</span></td>
        <td align="right" valign="top"
         ><span class="options">[<a href="#section-InstanceMethods"
         class="privatelink" onclick="toggle_private();"
         >hide private</a>]</span></td>
      </tr>
    </table>
  </td>
</tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a name="__init__"></a><span class="summary-sig-name">__init__</span>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">instr</span>)</span></td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.__init__">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#RemoveDelimiters" class="summary-sig-name">RemoveDelimiters</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Removes standard delimiting characters from the input text.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.RemoveDelimiters">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#ProcessInput" class="summary-sig-name">ProcessInput</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">repeatOnFail</span>=<span class="summary-sig-default">0</span>)</span><br />
      Processes the text provided to the constructor.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.ProcessInput">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#ExecuteCommand" class="summary-sig-name">ExecuteCommand</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Processes the input text according to the stored command(s).</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.ExecuteCommand">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#MBRdetector" class="summary-sig-name">MBRdetector</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Entry point for interpreting the input as an MBR.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.MBRdetector">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#DateDetector" class="summary-sig-name">DateDetector</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">alt</span>=<span class="summary-sig-default">None</span>,
        <span class="summary-sig-arg">raw</span>=<span class="summary-sig-default">False</span>)</span><br />
      Detects and interprets an FAT date value.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.DateDetector">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#GetDate" class="summary-sig-name">GetDate</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">dateNum</span>)</span><br />
      Performs the calculation necessary for converting a given dateNum 
      value to a tuple in the format (day, month name, year).</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetDate">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#TimeDetector" class="summary-sig-name">TimeDetector</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">alt</span>=<span class="summary-sig-default">None</span>,
        <span class="summary-sig-arg">raw</span>=<span class="summary-sig-default">False</span>)</span><br />
      Detects and interprets an FAT time value.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.TimeDetector">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#GetTime" class="summary-sig-name">GetTime</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">timeNum</span>,
        <span class="summary-sig-arg">msec</span>=<span class="summary-sig-default">0.0</span>)</span><br />
      Performs the calculation necessary for converting a given timeNum 
      value to a tuple in the format (hour, minutes, seconds).</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetTime">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#DateTimeDetector" class="summary-sig-name">DateTimeDetector</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Detects and interprets an FAT date and time value by calling 
      DateDetector() and TimeDetector() with the raw option set to True.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.DateTimeDetector">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#GetCommand" class="summary-sig-name">GetCommand</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">lines</span>)</span><br />
      Searches lines for supported commands which are then stored in the 
      self.commands list.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetCommand">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#GetPartInfo" class="summary-sig-name">GetPartInfo</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">entry</span>)</span><br />
      Retrieves a single primary partition's information from entry, stores
      it in a dictionary, and returns the dictionary.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetPartInfo">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#FATVBRdetector" class="summary-sig-name">FATVBRdetector</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Entry point for interpreting the input as an FAT VBR.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.FATVBRdetector">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#GetFATInfo" class="summary-sig-name">GetFATInfo</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Interprets the information from the FAT boot sector and returns a 
      dictionary with it.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetFATInfo">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#AddFATInfo" class="summary-sig-name">AddFATInfo</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">obj</span>,
        <span class="summary-sig-arg">byt</span>,
        <span class="summary-sig-arg">label</span>,
        <span class="summary-sig-arg">off</span>,
        <span class="summary-sig-arg">olen</span>,
        <span class="summary-sig-arg">dtype</span>)</span><br />
      To simplify the commands in GetFATInfo(), this method accepts a 
      dictionary object, the bytes from the VBR, the string to be the 
      dictionary key, the byte offset of the data, the length of the data, 
      and the data type which should be either 'ascii' or 'num'.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.AddFATInfo">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#FormatFATInfo" class="summary-sig-name">FormatFATInfo</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">info</span>)</span><br />
      Puts all the data from the dictionary info into a string for 
      printing.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.FormatFATInfo">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#GetCHS" class="summary-sig-name">GetCHS</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">entry</span>,
        <span class="summary-sig-arg">end</span>=<span class="summary-sig-default">False</span>)</span><br />
      Retrieves the Cylinder Head Sector address from an MBR partition 
      table entry.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetCHS">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#GetBytes" class="summary-sig-name">GetBytes</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">row</span>,
        <span class="summary-sig-arg">width</span>,
        <span class="summary-sig-arg">hexstr</span>=<span class="summary-sig-default">None</span>)</span><br />
      Returns a string of the hex bytes from the input string for the given
      row and width.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetBytes">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#DecodeHex" class="summary-sig-name">DecodeHex</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">numstr</span>=<span class="summary-sig-default">None</span>,
        <span class="summary-sig-arg">width</span>=<span class="summary-sig-default">16</span>,
        <span class="summary-sig-arg">pretty</span>=<span class="summary-sig-default">True</span>)</span><br />
      Returns the decoded hex string of numstr with newlines after width 
      characters.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.DecodeHex">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#CheckHex" class="summary-sig-name">CheckHex</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Determines if the input string has only valid hex characters.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.CheckHex">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#CheckBinary" class="summary-sig-name">CheckBinary</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Determines if the input string has only valid binary characters.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.CheckBinary">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#FormatPartInfo" class="summary-sig-name">FormatPartInfo</a>(<span class="summary-sig-arg">self</span>,
        <span class="summary-sig-arg">info</span>)</span><br />
      Accepts a list (info) that has the information for the four 
      partitions in the disk and formats them for being printed.</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.FormatPartInfo">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
<tr>
    <td width="15%" align="right" valign="top" class="summary">
      <span class="summary-type">&nbsp;</span>
    </td><td class="summary">
      <table width="100%" cellpadding="0" cellspacing="0" border="0">
        <tr>
          <td><span class="summary-sig"><a href="Forensie.Forensie-class.html#GetCommandDescriptions" class="summary-sig-name">GetCommandDescriptions</a>(<span class="summary-sig-arg">self</span>)</span><br />
      Returns a string with all supported commands in the format:</td>
          <td align="right" valign="top">
            <span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetCommandDescriptions">source&nbsp;code</a></span>
            
          </td>
        </tr>
      </table>
      
    </td>
  </tr>
</table>
<!-- ==================== METHOD DETAILS ==================== -->
<a name="section-MethodDetails"></a>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr bgcolor="#70b0f0" class="table-header">
  <td colspan="2" class="table-header">
    <table border="0" cellpadding="0" cellspacing="0" width="100%">
      <tr valign="top">
        <td align="left"><span class="table-header">Method Details</span></td>
        <td align="right" valign="top"
         ><span class="options">[<a href="#section-MethodDetails"
         class="privatelink" onclick="toggle_private();"
         >hide private</a>]</span></td>
      </tr>
    </table>
  </td>
</tr>
</table>
<a name="RemoveDelimiters"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">RemoveDelimiters</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.RemoveDelimiters">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Removes standard delimiting characters from the input text. No return 
  value. Instead, self.inputStr is changed directly.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="ProcessInput"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">ProcessInput</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">repeatOnFail</span>=<span class="sig-default">0</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.ProcessInput">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Processes the text provided to the constructor. This method is the 
  flagship of Forensie. All processing of text springboards from this 
  point. First the type of the input is determined, hex, binary, or other. 
  Binary text is converted to hex before futher processing. If neither 
  binary nor hex text is found, the first line is parsed for commands and 
  the rest of the lines are reprocessed for binary or hex text in a 
  recursive manner. All commands are kept cummulatively and are processed 
  in the order they were discovered.</p>
  <p>Returns a tuple in the form (printable results, 'success' or 'fail', 
  type of processing done to input).</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="ExecuteCommand"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">ExecuteCommand</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.ExecuteCommand">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Processes the input text according to the stored command(s). Calls the
  method corresponding to the first command given. Raises a FormatError if 
  no valid command is found. If called from ProcessInput(), this will cause
  the text to be processed as plain hex.</p>
  <p>Returns the value returned from whichever method is called.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="MBRdetector"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">MBRdetector</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.MBRdetector">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Entry point for interpreting the input as an MBR. Begins processing 
  the input text and determines if the length and boot signature are valid 
  before proceeding. Splits the four primary partition tables and sends 
  them each to GetPartInfo(). The information from these four entries 
  together make up the bulk of the valuable information in an MBR, so it is
  sent directly to FormatPartInfo().</p>
  <p>Returns a regular success tuple (see ProcessInput()).</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="DateDetector"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">DateDetector</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">alt</span>=<span class="sig-default">None</span>,
        <span class="sig-arg">raw</span>=<span class="sig-default">False</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.DateDetector">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Detects and interprets an FAT date value. Alternate text can be passed
  to alt if the calling code needs text other than the input string to be 
  processed. Also, if raw is True, the processing results are not put into 
  a string or the success tuple before being returned.</p>
  <p>Returns a regular success tuple (see ProcessInput()).</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="GetDate"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">GetDate</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">dateNum</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetDate">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Performs the calculation necessary for converting a given dateNum 
  value to a tuple in the format (day, month name, year). Raises 
  self.FormatError on any invalid values.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="TimeDetector"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">TimeDetector</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">alt</span>=<span class="sig-default">None</span>,
        <span class="sig-arg">raw</span>=<span class="sig-default">False</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.TimeDetector">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Detects and interprets an FAT time value. Alternate text can be passed
  to alt if the calling code needs text other than the input string to be 
  processed. Also, if raw is True, the processing results are not put into 
  a string or the success tuple before being returned. If the time value 
  includes 100ths of seconds, these are added to the values sent to 
  GetTime().</p>
  <p>Returns a regular success tuple (see ProcessInput()).</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="GetTime"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">GetTime</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">timeNum</span>,
        <span class="sig-arg">msec</span>=<span class="sig-default">0.0</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetTime">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Performs the calculation necessary for converting a given timeNum 
  value to a tuple in the format (hour, minutes, seconds). Raises 
  self.FormatError on any invalid values.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="DateTimeDetector"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">DateTimeDetector</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.DateTimeDetector">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Detects and interprets an FAT date and time value by calling 
  DateDetector() and TimeDetector() with the raw option set to True.</p>
  <p>Returns a regular success tuple (see ProcessInput()).</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="GetCommand"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">GetCommand</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">lines</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetCommand">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Searches lines for supported commands which are then stored in the 
  self.commands list. Any words that are not commands are simply 
  ignored.</p>
  <p>No return value.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="GetPartInfo"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">GetPartInfo</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">entry</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetPartInfo">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Retrieves a single primary partition's information from entry, stores 
  it in a dictionary, and returns the dictionary. The entry must be in 
  standard IBM compatible partition table format.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="FATVBRdetector"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">FATVBRdetector</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.FATVBRdetector">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Entry point for interpreting the input as an FAT VBR. Begins 
  processing the input text and determines if the length and boot signature
  are valid before proceeding. If the input text passes these tests, it is 
  passed on to GetFATInfo().</p>
  <p>Returns a regular success tuple (see ProcessInput()).</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="GetFATInfo"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">GetFATInfo</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetFATInfo">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Interprets the information from the FAT boot sector and returns a 
  dictionary with it. Works with FAT12/16/32.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="AddFATInfo"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">AddFATInfo</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">obj</span>,
        <span class="sig-arg">byt</span>,
        <span class="sig-arg">label</span>,
        <span class="sig-arg">off</span>,
        <span class="sig-arg">olen</span>,
        <span class="sig-arg">dtype</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.AddFATInfo">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>To simplify the commands in GetFATInfo(), this method accepts a 
  dictionary object, the bytes from the VBR, the string to be the 
  dictionary key, the byte offset of the data, the length of the data, and 
  the data type which should be either 'ascii' or 'num'. No return value 
  because the dictionary is added to directly.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="FormatFATInfo"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">FormatFATInfo</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">info</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.FormatFATInfo">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Puts all the data from the dictionary info into a string for printing.
  The categories are defined in a local tuple and looped through. All 
  categories that do not exist in info are skipped.</p>
  <p>Returns the string for printing.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="GetCHS"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">GetCHS</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">entry</span>,
        <span class="sig-arg">end</span>=<span class="sig-default">False</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetCHS">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Retrieves the Cylinder Head Sector address from an MBR partition table
  entry. Since both the start CHS and end CHS are calculated the same way, 
  if end is True, the offset will be changed so the proper values are put 
  into the calculation.</p>
  <p>Returns a tuple in the form (head, cylinder, sector).</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="GetBytes"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">GetBytes</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">row</span>,
        <span class="sig-arg">width</span>,
        <span class="sig-arg">hexstr</span>=<span class="sig-default">None</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetBytes">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Returns a string of the hex bytes from the input string for the given 
  row and width. Separates the bytes with a space.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="DecodeHex"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">DecodeHex</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">numstr</span>=<span class="sig-default">None</span>,
        <span class="sig-arg">width</span>=<span class="sig-default">16</span>,
        <span class="sig-arg">pretty</span>=<span class="sig-default">True</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.DecodeHex">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Returns the decoded hex string of numstr with newlines after width 
  characters. Replaces any non-printing characters with a period. If width 
  is infinity, no newline characters are inserted. If pretty is True 
  (default), the hex byte offset is printed in a column to the left, the 
  hex bytes are printed in a center column, the ASCII decoding is in a 
  column on the right, and a header with labels for the first two columns 
  are all added to the string.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="CheckHex"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">CheckHex</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.CheckHex">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Determines if the input string has only valid hex characters. Usually 
  this method is called from CheckBinary(), which calls this method when 
  its test for binary characters fails.</p>
  <p>No return value. Instead self.format is set to 'hex' or 'bad'.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="CheckBinary"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">CheckBinary</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.CheckBinary">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Determines if the input string has only valid binary characters. If 
  the test fails, this method calls CheckHex(). If the test passes, the 
  text is sent to be converted to hex before further processing, which 
  simplifies the writing of all other methods which process the input text.
  This method is the first before CheckHex() because it will fail earlier 
  on non-binary character strings given that the set of valid characters = 
  {'1', '0'}.</p>
  <p>No return value. Instead self.format is set to 'hex'.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="FormatPartInfo"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">FormatPartInfo</span>(<span class="sig-arg">self</span>,
        <span class="sig-arg">info</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.FormatPartInfo">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Accepts a list (info) that has the information for the four partitions
  in the disk and formats them for being printed. Uses the sector counts to
  determine if any unallocated spaces exist between the partitions and 
  inserts a notice at the top of the printed results if any are found.</p>
  <p>Returns the string.</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<a name="GetCommandDescriptions"></a>
<div>
<table class="details" border="1" cellpadding="3"
       cellspacing="0" width="100%" bgcolor="white">
<tr><td>
  <table width="100%" cellpadding="0" cellspacing="0" border="0">
  <tr valign="top"><td>
  <h3 class="epydoc"><span class="sig"><span class="sig-name">GetCommandDescriptions</span>(<span class="sig-arg">self</span>)</span>
  </h3>
  </td><td align="right" valign="top"
    ><span class="codelink"><a href="Forensie-pysrc.html#Forensie.GetCommandDescriptions">source&nbsp;code</a></span>&nbsp;
    </td>
  </tr></table>
  
  <p>Returns a string with all supported commands in the format:</p>
  <p>command: description command: description ...</p>
  <dl class="fields">
  </dl>
</td></tr></table>
</div>
<br />
<!-- ==================== NAVIGATION BAR ==================== -->
<table class="navbar" border="0" width="100%" cellpadding="0"
       bgcolor="#a0c0ff" cellspacing="0">
  <tr valign="middle">

  <!-- Tree link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="module-tree.html">Trees</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Index link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="identifier-index.html">Indices</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Help link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="help.html">Help</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Project homepage -->
      <th class="navbar" align="right" width="100%">
        <table border="0" cellpadding="0" cellspacing="0">
          <tr><th class="navbar" align="center"
            ><a class="navbar" target="_top" href="http://code.google.com/p/forensie/">Forensie</a></th>
          </tr></table></th>
  </tr>
</table>
<table border="0" cellpadding="0" cellspacing="0" width="100%%">
  <tr>
    <td align="left" class="footer">
    Generated by Epydoc 3.0.1 on Tue May 04 17:43:52 2010
    </td>
    <td align="right" class="footer">
      <a target="mainFrame" href="http://epydoc.sourceforge.net"
        >http://epydoc.sourceforge.net</a>
    </td>
  </tr>
</table>

<script type="text/javascript">
  <!--
  // Private objects are initially displayed (because if
  // javascript is turned off then we want them to be
  // visible); but by default, we want to hide them.  So hide
  // them unless we have a cookie that says to show them.
  checkCookie();
  // -->
</script>
</body>
</html>
